GM Lan Single Wire CAN Bus Sniffing

[foxdie]

Without having looked at your hardware setup, I have to ask if you tried tying CANL to ground to turn your interface into a single-ended one? Make sure you understand your hardware first though.

Hi ghodge, I believe I specified this in a previous post but I'll clarify what I've tested;

• CAN_H connected to OBD-II, CAN_L connected to GND
• CAN_H connected to head unit green wire, CAN_L connected to GND
• CAN_H connected to OBD-II, CAN_L connected to nothing
• CAN_H connected to head unit green wire, CAN_L connected to nothing
• CAN_H connected to OBD-II, CAN_L connected to CAN_H

The results are always the same, either no communication or receive-only.

[jezzab]

Connected to the OBDII port. Can Hi tied to can low. I can send make chimes, do door locks etc. I can even change the startup logo on the radio with a couple of packets. But that's another story altogether :p

Well, I tried tying CAN_H to CAN_L and it made things worse, no packets received. This is understandable though, the MCP2551 won't have anything to differentiate against if both signals equal each other.

I'm interested in the startup logo change via CAN. I already know the location of both the logo and VIM addresses in the EEPROM (and how to enable it via reflashing the IC with a clip-on programmer).

I made a few little apps that did little things like make the door locks go up and down with the steering wheel scroll wheel. One that reads the outside temp and displays it on the DIC on the instrument cluster. And a few more

So far all I've written is read-only stuff, such as "turn on this LED when the steering wheel scroll wheel is depressed" etc once I crack being able to transmit packets I"ll be able to do a lot more too. It's maddening to be so short of the goal, but gives me time to daydream and use my imagination to come up with endless possibilities

One such thing I'm planning on coding on my mbed is auto-closure; Roll up the windows when the car lock button is double-pressed. I know how to do this, having already played with the building blocks. It's just time to assemble it.

Sorry meant tie CAN L to ground. Oops.

I tried making an app a while ago that did the windows up on double lock etc. didn't work. Seems the switches are wired directly to the BCM. Other ways to do it but I just wanted to send a simple windows up gmlan command

[ghodge]

Yes. So much seems to be unavailable to us through GMLAN

foxdie, I looked at the picture of your setup and the schematics for your CANBus interface but I just wanted to verify with you that you CANL tied to GRD while at the same time, JP3 is not installed. If JP3 is installed, the balancing resistor may be causing you trouble.

[ghodge]

When I was having trouble interfacing with GMLAN using the MCP2515 based CANBus shield, I was able to put the MCP2515 into loopback mode to verify that my programming was at least somewhat correct. Is that something that you can do with your setup? That would at least rule out issues with the transceiver board/connection to the car.

[jezzab]

Yes. So much seems to be unavailable to us through GMLAN

foxdie, I looked at the picture of your setup and the schematics for your CANBus interface but I just wanted to verify with you that you CANL tied to GRD while at the same time, JP3 is not installed. If JP3 is installed, the balancing resistor may be causing you trouble.

You can control the windows but the problem is you have to out the BCM in diagnostics tester mode and it just turns into a pita. Plus it wants ignition on etc

[jezzab]

I'm interested in the startup logo change via CAN. I already know the location of both the logo and VIM addresses in the EEPROM (and how to enable it via reflashing the IC with a clip-on programmer).

Its all about DIDs. Read your GM white papers. They won't tell you the location but they will give you a path to travel down. And the world of 11bit SWCAN 29bit is fun but the real gems are 11bit as you are talking directly to a module and JUST that module and can access its memory etc. all the the thing it's writing to the EEPROMs etc. and it's internal chips

Your don't need security access to get the ones you want too. Some require it (seed/key)

[foxdie]

Well, managed to do some more research into this, but gotten no further.


(high res)

Upon my request, Proto-Pic (very friendly hobbyist electronics retailer in the UK) stocked some NCV7356 J2411 Single-Wire CAN BUS ICs. I bought a handful of them, soldered them to a SOIC to DIP adapter and, after a lot of hassle, managed to get this receiving packets too, but alas no transmit.

I also bought an XMEGA Xprotolab (really cool breadboard-mount tiny oscilloscope + multimeter + logic tester + signal generator) at the same time so I could see what the hell was going on. One thing I did notice was that the transmit pin on the mbed wasn't changing state at all when I attempted to transmit a packet. This would obviously be the cause of my woes but why the hell isn't it transmitting a packet?

Appears I have a lot more work ahead of me

[SteveG8]

I had a similar issue when I was doing my elm329 board and it turned out I was supplying only 5v to the SWCan ship on the main power pin (#5 on your chip, I used the th8056 - looking at the spec/schematic basically identical). Once I gave it the proper ~12v from the OBD port it started working
I'd triple check to make sure you have everything hooked up per spec around the SWCAN chip

[foxdie]

Hi Steve,

I was very careful to wire up the chip to the specs, I did want to power it from the mbed, but I powered it from the OBD +VE feed (12-14V).

I've rebuilt the circuit with neatness in mind, here's the circuit as it should be, green highlights components I have populated, the others aren't;

singlewirecan.jpg

I did some some more testing, it appears I hit 2 obstacles;

1. The mbed CAN libraries happily receive and decode both 11 and 29 bit CAN packets, it wasn't clear which was the default to transmit, turns out it was 11, so after some more digging I found out how to switch it to 29 bit mode.
2. The mbed isn't changing the state of its transmit line when told to transmit. I'm not sure if it's waiting for something, like its waiting for the right time to send data, but it won't transmit. The function to write to the CAN BUS in mbed's IDE returns success immediately though.

Will do some more research tomorrow.

[foxdie]

Finally, I bloody got there



Turns out that mbed's CAN library's "monitor mode" feature not only disables ACK'ing of all received packets, it completely disables the transmit line.

It's always something small / stupid / seemingly insignificant that trips you up in life isn't it?